CVE catalog

CVE-2026-33515

Severity: Critical · CVSS 9.2
Published: Mar 24, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.06% · Oct 25, 2026

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	squid	sid	`7.7-1`	fixed
Debian	squid	forky	`7.7-1`	fixed
Debian	squid	trixie	`6.13-2+deb13u3`	fixed
Debian	squid	trixie-security	`6.13-2+deb13u2`	fixed
Debian	squid	bookworm	`5.7-2+deb12u5`	vulnerable
Debian	squid	bookworm-security	`5.7-2+deb12u6`	fixed
Cpe	squid	Not reported	Not reported	vulnerable
Cpe	squid	Not reported	`6.14-0ubuntu0.24.04.2`	fixed
Cpe	squid-cgi	Not reported	`6.14-0ubuntu0.24.04.2`	fixed
Cpe	squid-common	Not reported	`6.14-0ubuntu0.24.04.2`	fixed
Cpe	squid-openssl	Not reported	`6.14-0ubuntu0.24.04.2`	fixed
Cpe	squid-purge	Not reported	`6.14-0ubuntu0.24.04.2`	fixed
Cpe	squidclient	Not reported	`6.14-0ubuntu0.24.04.2`	fixed
Cpe	squid	Not reported	`7.5`	fixed
Ubuntu	squid	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-cgi	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-common	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-openssl	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-purge	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squidclient	noble	`6.14-0ubuntu0.24.04.5`	fixed
Opensuse	squid	tumbleweed	`7.7-2.1`	fixed
Ubuntu	squid3	pro	`3.5.23-5ubuntu1`	vulnerable
Ubuntu	squid3	pro	`3.5.23-5ubuntu2`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.1`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.2`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.3`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.4`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.5`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.6`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.7`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.8`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.9`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.10`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.11`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.12`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.13`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm1`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm2`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm3`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm4`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm5`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm6`	fixed
Ubuntu	squid	pro	`4.8-1ubuntu2`	vulnerable
Ubuntu	squid	pro	`4.8-1ubuntu3`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu1`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu2`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu3`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu4`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.1`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.2`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.3`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.4`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.5`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.6`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.7`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.8`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.9`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.10`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.11`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.12`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13+esm1`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13+esm2`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13+esm3`	fixed
Ubuntu	squid	22.04	`4.13-10ubuntu5`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu1`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu3`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4.1`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4.2`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4.3`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.1`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.2`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.3`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.4`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.1`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.2`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.3`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.4`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.5`	fixed
Ubuntu	squid	24.04	`6.1-2ubuntu1`	vulnerable
Ubuntu	squid	24.04	`6.1-2ubuntu2`	vulnerable
Ubuntu	squid	24.04	`6.5-1ubuntu1`	vulnerable
Ubuntu	squid	24.04	`6.5-1ubuntu2`	vulnerable
Ubuntu	squid	24.04	`6.5-1ubuntu3`	vulnerable
Ubuntu	squid	24.04	`6.6-1ubuntu4`	vulnerable
Ubuntu	squid	24.04	`6.6-1ubuntu5`	vulnerable
Ubuntu	squid	24.04	`6.6-1ubuntu5.1`	vulnerable
Ubuntu	squid	24.04	`6.10-0ubuntu0.24.04.1`	vulnerable
Ubuntu	squid	24.04	`6.13-0ubuntu0.24.04.1`	vulnerable
Ubuntu	squid	24.04	`6.13-0ubuntu0.24.04.2`	vulnerable
Ubuntu	squid	24.04	`6.13-0ubuntu0.24.04.3`	vulnerable
Ubuntu	squid	24.04	`6.14-0ubuntu0.24.04.1`	vulnerable
Ubuntu	squid	24.04	`6.14-0ubuntu0.24.04.2`	fixed
Ubuntu	squid	25.10	`6.13-1ubuntu1`	vulnerable
Ubuntu	squid	25.10	`6.13-1ubuntu2`	vulnerable
Ubuntu	squid	25.10	`6.13-1ubuntu3`	vulnerable
Ubuntu	squid	25.10	`6.13-1ubuntu4`	vulnerable
Ubuntu	squid	25.10	`6.13-1ubuntu4.1`	vulnerable
Ubuntu	squid	25.10	`6.14-0ubuntu0.25.10.1`	vulnerable
Ubuntu	squid	25.10	`6.14-0ubuntu0.25.10.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	squid	source	sid	`7.5-1`	not yet assigned	Not reported	Not reported
Debian	squid	source	forky	`7.5-1`	not yet assigned	Not reported	Not reported
Debian	squid	source	trixie	`6.13-2+deb13u2`	not yet assigned	Not reported	Not reported
Debian	squid	source	bookworm	`5.7-2+deb12u6`	not yet assigned	Not reported	Not reported
Cpe	squid	cpe	Not reported	`6.14-0ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	squid-cgi	cpe	Not reported	`6.14-0ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	squid-common	cpe	Not reported	`6.14-0ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	squid-openssl	cpe	Not reported	`6.14-0ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	squid-purge	cpe	Not reported	`6.14-0ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	squidclient	cpe	Not reported	`6.14-0ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	squid	cpe	Not reported	`7.5`	Not reported	Not reported	Not reported
Ubuntu	squid	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-cgi	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-common	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-openssl	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-purge	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squidclient	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Opensuse	squid	rpm	tumbleweed	`7.7-2.1`	Not reported	OPENSUSE-SU-2026:11937-1	Not reported
Ubuntu	squid3	deb	pro	`3.5.27-1ubuntu1.14+esm6`	Not reported	UBUNTU-CVE-2026-33515	Not reported
Ubuntu	squid	deb	pro	`4.10-1ubuntu1.13+esm3`	Not reported	UBUNTU-CVE-2026-33515	Not reported
Ubuntu	squid	deb	22.04	`5.9-0ubuntu0.22.04.5`	Not reported	UBUNTU-CVE-2026-33515	Not reported
Ubuntu	squid	deb	24.04	`6.14-0ubuntu0.24.04.2`	Not reported	UBUNTU-CVE-2026-33515	Not reported
Ubuntu	squid	deb	25.10	`6.14-0ubuntu0.25.10.2`	Not reported	UBUNTU-CVE-2026-33515	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[squid]Affected
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
[squid-cgi]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
[squidclient]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
[squid-common]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · all · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u5 · all · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · all · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · all · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
[squid-openssl]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
[squid-purge]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 5.7-2+deb12u6
  nvd · squid · debian · bookworm; nvd · squid · debian · 12

[openSUSE Tumbleweed]

[squid]Affected
Source package: [squid]
Details (1)
- 7.6-1.3 · x86_64 · tumbleweed
  Affected · Fixed: 7.7-2.1
  nvd · squid · opensuse · tumbleweed

[Debian 13 (Trixie)]

[squid]Fixed
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
[squid-cgi]Fixed
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
[squidclient]Fixed
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
[squid-common]Fixed
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · all · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
[squid-openssl]Fixed
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
[squid-purge]Fixed
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 6.13-2+deb13u2
  nvd · squid · debian · 13

Observed: Oct 27, 2026, 8:03:05 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]